Checkpoint VPN-1 Time dependancy Info Required

[Austin]

Hello,

I am after some information about how Checkpoint Secure client works. I am currently learning my trade, so please ask questions if I have not provided enough information.

We have a number of users who are required to change the system time on there PCs. This causes there VPN connection to disconnect. Also, once the time has been changed, whether connected or disconnected, it will not allow the user to reconnect. I assume there is a threshold that the system time can be ‘out’.

I understand this may be a ‘limitation’ of the system, so my priority is understanding why it behaves this way. Providing a solution or workaround for these users is secondary.

I have checked the certificate expiry date, but the times which they are changing there system clock too does exceed the expiry.

I suspect that the system either deems the changing of the system clock suspicious activity and drops the connection, or the system is dependant on the system clock being accurate for other reasons. As I said before, I do not know why it behaves this way, but would like to understand why.

Other Info-

User is using Checkpoint VPN-1 Sercureclient NGX R60
Nokia IP 530 Firewall
Checkpoint Smart Console R55

Thanks for your time,

[RayPesek]

There is a setting in the SmartCenter where you can change the "window" of allowed time differences. I think the default is one hour.

If the client is too far in the future, then their clock will be in the future as far as the certificate revocation list is concerned.

When you're using certs in any application, synced time is mandatory. If you use Symantec AntiVirus Corporate Edition v10, which uses certs to authenticate the management server to the client, you'll see messages in it if there is too much of a time difference and you'll be unable to manage the anti-virus on the clients.

Ray